# US 12,118,492 B2 · Methods and apparatus for data-driven vendor risk assessment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,492 B2 - Document ID: US12118492B2 - Status: Granted - Kind: B2 - Application number: 17/019,899 - Filed: 2020-09-14 - Published: 2021-03-25 - Granted: 2024-10-15 - Earliest claimed: 2019-09-20 - Assignees: Privva, Inc. - Applicants: Privva, Inc. - Inventors: Ishan Girdhar; John Lemp; Sammy Elhag - Web page: https://patentgrep.com/patent/US12118492B2 ## CPC - G06Q 10/0635: Risk analysis of enterprise or organisation activities - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06Q 30/018: Certifying business or products - H04L 63/1433: {Vulnerability analysis} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The techniques described herein relate to methods, apparatus, and computer readable media configured to provide data-driven vendor risk assessment. In some aspects, a distributed computer system is provided that includes an interface component adapted to obtain security status information from at least two software application components, the at least two software application components being used by an organizational entity. The distributed computer system also includes a monitoring component adapted to receive the security status information from the at least two software application components and to determine a security status of the organizational entity based on the received security status information. ## Claims ### Claim 1 A computer system comprising one or more processors in communication with a computer-readable storage media storing instructions that, when executed by the one or more processors, cause the one or more processors to: generate a display for a graphical user interface comprising a plurality of monitored elements of an organizational entity, wherein the plurality of monitored elements correspond to predefined or user-specified security objectives; accept user input from the user interacting with the graphical user interface, the input assigning at least two software application components to each of the plurality of monitored elements of the organizational entity, wherein each of the at least two software application components performs a different operation; obtain security status information from the at least two software application components, the at least two software application components being used by an organizational entity, wherein, for each of the at least two software application components, the security status includes data points associated with operation of the software application component; map the data points of the security status information, for each of the at least two software application components, to relevant one or more of the plurality of monitored elements of the organizational entity based on stored mapping information; determine, for each of the plurality of monitored elements, a score based on the mapping of the data points to the plurality of monitored elements; determine a security status of the organizational entity by determining a weighted measure based on the score and first weighting information associated with each of the plurality of monitored elements; transmit, to the graphical user interface for display: the score for each of the plurality of monitored elements; and the security status; and generate and transmit, to the graphical user interface for display, an alert upon determining a change in a value of the security status of the organizational entity. ### Claim 2 (depends on 1) The computer system according to claim 1, wherein: the security status information comprises a security metric; and determining the security status comprises interpreting the security metric based on a predetermined formula for the organizational entity. ### Claim 3 (depends on 1) The computer system according to claim 1, further comprising a display configured to display, to a user, the obtained security status information. ### Claim 4 (depends on 1) The computer system according to claim 1, wherein the security status information from the at least two software application components is used to determine a security score that indicates the security status of the organizational entity. ### Claim 5 (depends on 4) The computer system according to claim 4, further comprising updating the security score in real time responsive to real-time collection of the security status information from at least two software application components. ### Claim 6 (depends on 4) The computer system according to claim 4, wherein the security score is determined using respective weighting of the at least two software application components. ### Claim 7 (depends on 1) The computer system according to claim 1, wherein the monitoring component is adapted to determine a security status of at least one of the at least two software application components based on the obtained security status information. ### Claim 8 (depends on 7) The computer system according to claim 7, wherein the at least one of the at least two software applications is provided by a vendor outside of the organizational entity and wherein the monitoring component is adapted to determine a security status of the vendor. ### Claim 9 (depends on 7) The computer system according to claim 7, wherein the monitoring component is adapted to determine a security score that indicates a risk level associated with using the at least one of the at least two software applications provided by the vendor. ### Claim 10 (depends on 7) The computer system according to claim 7, wherein the monitoring component is adapted to determine an aggregated security score that indicates a risk level associated with using a plurality of software components provided by a plurality of vendors. ### Claim 11 (depends on 1) The computer system according to claim 1, wherein the security status information is obtained from at least one of the group comprising: an API; a data log; and a data push. ### Claim 12 (depends on 1) The computer system according to claim 1, wherein the instructions, when executed by the one or more processors, cause the one or more processors to generate, within a user display, a dashboard display element comprising a plurality of monitored categories of software application components being used by the organizational entity. ### Claim 13 (depends on 12) The computer system according to claim 12, wherein the plurality of monitored categories of software application components comprises: application components; network components; and organizational components. ### Claim 14 (depends on 1) The computer system according to claim 1, further comprising a mapping that identifies a relationship between a data element associated with security status information of at least one of the at least two software application components to a monitored element. ### Claim 15 (depends on 14) The computer system according to claim 14, further comprising a memory adapted to store the mapping as mapping information. ### Claim 16 (depends on 15) The computer system according to claim 15, wherein the mapping information includes, for a vendor that provides one or more software components, a set of mapping elements that relate to a risk of use of the one or more provided software components by the organizational entity. ### Claim 17 (depends on 15) The computer system according to claim 15, wherein the memory is adapted to store parameter values of one or more monitored elements. ### Claim 18 (depends on 17) The computer system according to claim 17, wherein the memory is adapted to store combination logic, the combination logic being used by the monitoring component to determine a security status responsive to the stored parameter values. ### Claim 19 A computerized method comprising: generating a display for a graphical user interface comprising a plurality of monitored elements of an organizational entity, wherein the plurality of monitored elements correspond to predefined or user-specified security objectives; accepting user input from the user interacting with the graphical user interface, the input assigning at least two software application components to each of the plurality of monitored elements of the organizational entity, wherein each of the at least two software application components performs a different operation; obtaining security status information from the at least two software application components, the at least two software application components being used by an organizational entity, wherein, for each of the at least two software application components, the security status includes data points associated with operation of the software application component; mapping the data points of the security status information, for each of the at least two software application components, to relevant one or more of the plurality of monitored elements of the organizational entity based on stored mapping information; determining, for each of the plurality of monitored elements, a score based on the mapping of the data points to the plurality of monitored elements; determining a security status of the organizational entity by determining a weighted measure based on the score and first weighting information associated with each of the plurality of monitored elements; transmitting, to the graphical user interface for display: the score for each of the plurality of monitored elements; and the security status; and generating and transmitting, to the graphical user interface for display, an alert upon determining a change in a value of the security status of the organizational entity.